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DETAILED ACTION 

i> This action is in response to Applicant's amendment and remarks. Claims 1-59 are 
presented for further examination. 

2> This is a final rejection. 



Response to Arguments 

3> Applicaiit's arguments with respect to claims 1-59 have been considered but are moot 
in view of the new ground(s) of rejection necessitated by Applicant's amendment. 



Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form 

the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another 
filed in the United States before the invention by the applicant for patent or (2) a patent granted on an 
application for patent by another filed in the United States before the invention by the applicant for patent, 
except that an international application filed under the treaty defined in section 351(a) shall have the effects 
for purposes of this subsection of an application filed in the United States only if the international 
application designated the United States and was published under Article 21(2) of such treaty in the English 
language. 



4> Claims 1-5, 21-25, and 26-30 are rejected under 35 U.S.C § 102(e) as being anticipated by 
Win et al, U.S Patent No. 6.453.353-[" Win^']. 



5> Win was cited by Examiner in previous Office Action, dated 4.15.2005. 
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6> As to claim 1, Win discloses a method for providing a first network resource access to 
a second network resource, comprising; 

locating a profile using profile data obtained from a client device, the profile 
containing data for identifying and for accessing the second network resource [Figure 4 
«items 106, 208, io8» | column 5 «lines 44-54» | column 7 «lines 45-57» | column 10 «lines 45- 
55» where : Win*s access server contains a protected resource, uses user's identification to 
request the user's profile from a registry server, the user profile containing the user's roles, 
the I'oles defining resources accessible to the user]; 

supplying the profile to the second network resource [column 10 «lines 47-49»]; 

receiving, from the second network resource, temporary credentials for accessing the 
second network resource and genei*ated according to the profile [column 6 «lines 48-54» | 
column 10 «line 5i» to column 11 «line 9» where : Win's access server genei*ates a temporaiy 
cookie that is transmitted to the user, and the cookie provides the information that enables a 
user to access his resources based on his profile (role)]; and 

providing the first network resource with the temporary credentials so that the first 
network resource can provide the second network resource with the temporaiy credentials to 
access the second network resource on behalf of the client device [column 6 «lines 48-54» | 
column 10 «line 5i» to column 11 «line g» where : the cookie is supplied to a browser that 
accesses the protected resources for the user device]. 
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7> As to claim 2, Win discloses the method further comprising the act of invalidating the 
temporaiy credentials following a termination event [column 11 «lines 6-9» where : a cookie 
can be set to expire]. 

8> As to claim 3, Win discloses the method wherein the termination event involves the 
lapse of a set time period [column 11 «lines 6-9»]. 

9> As to claim 4, Win discloses the method wherein the termination even involves the 
first network resource accessing the second network resource [column 11 «lines 6-7» where : 
when a cookie expiration is set to o, the cookie is not saved on a computer. That is, a cookie 
is used once for a session and then the cookie expires], 

io> As to claim 5, Win discloses the method wherein the temporary credentials that 
provide limited access to the network resource [column 11 «lines 53-64» where : the 
personalized menu contains only those resources that are accessible to the user]. 

ii> As to claims 21-25, as they are mediums that execute the steps of the method of claims 
i'5, respectively, they do not teach or further define over the claimed limitations. Therefore 
claims 21-25 are rejected for the same reasons set forth for claims 1-5, supra. 



I2> As to claims 26-29, as they do not teach or further define over the steps of the method 
of claims 1-5, they are rejected for at least the reasons set forth for claims 1-5. 
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I3> As to claim 30, Win discloses the medium having instructions for generating an 
interface includes generating a framed web page having a first frame and a second frame, the 
method further comprising providing, for the first frame, content for directing an 
application, and providing, for the second frame, content for selecting one or more electronic 
files managed by the data service identified by the specified profile [column 5 «lines 44-46» | 
column 6 «lines io-i6» | column 9 «lines 20'30» | column 11 «lines 33-64» | column iz «Iines 3-8 
and 65'66» where : Win's roles are analogous to user profiles. And Win discloses web pages 
with functionality for directing an application and selecting one or more electronic files but 
does not explicitly disclose that the two functionalities are split amongst two frames within a 
page. Win does disclose that the user options are presented in a personalized HTML menu 
and that the browser should be compatible with frames. Further, frames are ubiquitous in the 
art and based on Win's on suggestsions, would be expected in Win's HTML pages. The 
claimed use of a first frame and second frame is merely matter of design choice and does not 
represent any patentable distinction over the prior art references]. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art 
are such that the subject matter as a whole would have been obvious at the time the invention was made to a 
person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 
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14> Claims 6-12, 14-19, 32-42, 44-51, 54-56, 58 and 59 are rejected under 35 U.S.C § 103(a) as 
being unpatentable over Win, in view of Brown et al, U.S Patent Publication No. 
2003I0061275 ["Brown"]. 

I5> As to claim 6, Win discloses a method for enabling an application server to access a 
data server, comprising: 

the application server instructing a client to provide profile data to an identification 
service, the identification service having access to one or more profiles used to access one or 
more data servers, the profile data identifying a pai'ticular profile [Figure 4 «items 106, 410, 
io8» I column 5 «lines 44-54» | column 9 «lines 33-6o» | column 10 «lines 45-55 where : Win*s 
access server corresponds to an application server, his ACL and authentication client 
correspond to an identification service as it utilizes user identification to request a profile 
from Win's registi-y server]; 

the identification service locating the particular profile using the profile data received 
from a client device, the profile containing data for identifying and for accessing the data 
service [column 10 «lines 45'55»]; 

the identification service providing the profile to the data service [Figure 4 | column 
10 «lines 47-49» where : Win's HTTP server, runtime module, and protected resources are 
provided with the profile from the registiy]; and 

the data service generating temporary credentials for accessing the data service 
identified by the particular profile [column 6 «lines 48-54» | column 10 «lines 55-63» where : 
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the HTTP server generates a cookie for the user to access the protected resources, the HTTP 
and resources part of the access server data service]. 

Win does not expressly disclose that the application server obtains the temporary 
credentials and providing the data service with the temporaiy credentials to access the data 
service on behalf of the client. 

i6> In a related field of invention, Brown is directed towards a system for enabling a user 
to access resources. Brown further discloses a system that enables a proxy device to access the 
resources using credentials and rights of a user device Brown discloses an proxy server 
obtiaining temporary credentials that wex-e generated for a client, and provides a data service 
with the temporary credentials to access the data service on behalf of the client [0019, 0020, 
0022]. According to Brown, it is advantageous to provide a proxy server that obtains the 
temporary credentials for a user, and access the requested services on behalf of a user because 
such an implementation increases the level of security and enabling user access from 
multiple locations[oo26, 0027]. Brown^s system is analogous with respect to Win except 
Brown's proxy server provides the added functionality of being able to act for the client by 
providing the necessaiy credentials (in this comparison, Win's HTTP server would 
correspond to a proxy). Therefore, it would have been obvious to one of ordinary skill in the 
art to modify Win's resource access system to include the proxy server functionality 
provided by Brown^s teachings. The combination of Win and Brown would thus provide a 
system where a proxy obtains credentials of a user and accesses a data service on behalf of the 
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user when the user makes a request for resources. One would have been motivated to provide 

such an implementation for the advantages discussed. ✓ 

I7> As to claim 7, Win discloses the method wherein the act of instructing the client 
includes providing a user interface that includes instructions to send profile data to the 
identification service, and sending the interface to the client [Figure 5A «item 504»]. 

i8> As to claim 8, Win discloses the method wherein the act of instructing the client 
comprises redirecting the client to the identification service [Figuie 4 «items 402, 406, 4I4» | 
column 9 «lines 23-'27»]. 

19> As to claims 9 and 10, as they do not teach or further define over the claimed 
limitations of claims 2 and 5, respectively, they are rejected for the same reasons set forth for 
claims 2 and 5, supra. 

20> As to claim 11, Win discloses the method further comprising the application server 
generating an interface includes generating a framed web page having a first frame and a 
second frame, the method further comprising providing, for the first frame, content for 
directing an application, and providing, for the second frame, content for selecting one or 
more electronic files managed by the data service identified by the specified profile [column 5 
«lines 44-46» | column 6 «lines iO'i6» | column 9 «lines 2o-30» | column 11 «lines 33-64» | 
column 12 «lines 3-8 and 65'66» where : Win's roles are analogous to user profiles. And Win 
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discloses web pages with functionality for directing an application and selecting one or more 
electronic files but does not explicitly disclose that the two functionalities are split amongst 
two frames but does disclose that the user options are presented in a personalized HTML 
menu and that the browser should be compatible with frames. Frames are ubiquitous in the 
art and therefore would be expected in Win's HTML pages. The claimed use of a first frame 
and second frame is merely a design choice and does not represent any patentable distinction 
over the prior art references]. 

2i> As to claim 12, Win discloses the act of sending the profile data includes sending a 
cookie identifying the particular profile upon opening the framed web page, [column 8 
«lines 23-3i» ] column 10 «lines 5i-'54» | column 12 «line 65'66» | column 19 «lines 3-5»]. 

22> As to claim 14, Win discloses a method for enabling an application to acciBss a data 
service, comprising: 

the application server receiving, from a client, a request to direct an application 
[Figure 4 I Figure 5A]; 

the application server, instructing the client to provide profile data to an identification 
service, the identification service having access to one or more profiles for identifying 
accessing one or more data services, the profile data identifying a particular profile [Figure 4 
«items 106, 410, io8» | column 5 «lines 44-54» | column 10 «lines 45-55]; 
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the identification service providing the data service with the particular profile 
identified by the profile data, the profile containing data for identifying and accessing the 
data service [Figure 4 | column 10 «lines 45-55»]; and 

the data service using the profile to generate temporaiy credentials for accessing the 
data service [column 6 «lines 48'54» | column 10 «lines 55-63» where : the HTTP server 
generates a cookie for the user to access the protected resources, the HTTP and resources part 
of the access server data sei-vice]. 

Win does not expressly disclose that the application server obtaining the temporary 
credentials and providing the data service with the temporary credentials to access the data 
service on behalf of the client. 

23> In a related field of invention, Brown is directed towards a system for enabling a user 
to access protected resources. Brown further discloses a system that enables a proxy device to 
access protected resources using the credentials and rights of a user device Brown discloses an 
proxy server obtaining temporaiy credentials that were generated for a client, and provides a 
data service with the temporary credentials to access the data service on behalf of the client 
[0019, 0020, 0022]. According to Brown, it is advantageous to provide a proxy server that 
obtains the temporaiy credentials for a user, and access the requested services on behalf of a 
user because such an implementation increases the level of security and enabling user access 
from multiple locations[oo26, 0027]. Therefore, it would have been obvious to one of 
ordinaiy skill in the art to modify Win's resource access system to include the proxy server 
functionality provided by Brown's teachings. The combination of Win and Brown would 
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thus provide a system where a proxy obtains credentials of a user and accesses a data service 
on behalf of the user when the user makes a re^quest for resources. One would have been 
motivated to provide such an implementation for the advantages discussed. 

24> As to claims 15-18, as they do not teach or further define over the claimed limitations, 
they are rejected for the same reasons set forth for claims 7-10, supra. 

25> As to claim 19, as it does not teach or further define over the claimed limitations, it is 
rejected for the same reasons set forth for claim 11. 

26> As to claim 32, Win discloses a computable readable medium having instructions for: 
generating an interface having user accessible controls for creating a profile for 

accessing a data service [column 10 «lines 4i-5i» | column ii «lines 2i-32» | column 13 «line 40» 

to column 17 «line 38»]; 

creating a profile according to selections made through the interface the profile 

containing data for identifying and accessing the data service [column 12 «lines 55'6o» | 

column 13 «line 40» to column 17 «line 38»]; 

providing a chent device with profile data identifying a created profile [column 10 

«lines 4i-45»]; 

upon receiving profile data, retrieving a pi'ofile identified by the profile data received 
[column 10 «lines 47'49»]; and 
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generating temporaiy credentials for accessing the idata service identified by the 
retrieved profile [column 10 «lines 5i-63»]. 

Win does not expressly disclose that the application server obtaining the temporary 
credentials and providing the data service with the temporaiy credentials to access the data 
sei vice on behalf of the client. 

27> In a related field of invention, Brown is directed towards a system for enabling a user 
to access protected resources. Brown further discloses a system that enables a proxy device to 
access protected resources using the credentials and rights of a user device Brown discloses an 
proxy server obtaining temporaiy credentials that were generated for a client, and provides a 
data service with the temporaiy credentials to access the data service on behalf of the client 
[0019, 0020, 0022]. According to Brown, it is advantageous to provide a proxy server that 
obtains the temporaiy credentials for a user, and access the requested services on behalf of a 
user because such an implementation increases the level of security and enabling user access 
from multiple locations[oo26, 0027]. Therefore, it would have been obvious to one of 
ordinary skill in the art to modify Win's resource access system to include the proxy server 
functionality provided by Brown's teachings. The combination of Win and Brown would 
thus provide a system where a proxy obtains credentials of a user and accesses a data service 
on behalf of the user when the user makes a request for resources. One would have been 
motivated to provide such an implementation for the advantages discussed. 
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28> As to claims 33'36, as they are claims to a medium that execute the steps of the 
method of claims 2-5 respectively, they do not teach or further define over the claimed 
limitations. Therefore claims 33-36 are rejected for the same reasons set forth for claims 2-5. 

29> As to claim 37, Win discloses instructions for providing a client device with profile 
data comprise instructions for generating a cookie containing data identifying the created 
profile and instructing a web browser operating on the client to save the cookie [Figure 5C] 

30 As to claim 38, as it does not teach or further define over the previously claimed 
liinitations (see for example, claims i, 6, and 32), claim 38 is rejected for at least the same 
reasons. 

3i> As to claims 39-41, as they are claims to mediums that execute the steps of the method 
of claims 7, 8 and 10, they do not teach or further define over the claimed limitations. 
Therefore claims 39-41 are rejected for the same reasons set foi'th for claims 7, 8 and 10. 

32> As to claim 42, as it is a claim to a medium that executes the steps of the method of 
claim II, it does not teach or further define over the claimed limitations. Therefore, claim 42 
is rejected for the same reasons set forth for claim 11. 



33> As to claim 44, Win discloses a system for providing a first server with access to a 
second server, comprisitig: 



Application/Control Number: 10/085,971 Page 14 

Art Unit: 2152 

an identification service in network communication with a credential module, the 
credential module operable to use a pi'ofile acquired by the identification service to generate 
temporaiy credentials for accessing the second server [Figure 4 | column 10 «lines 4i-49»], the 
identification service being operable to receive profile data from a client, to acquire a profile 
identified by the profile data [column 10 «lines 4i-45»]. 

Win does not expressly disclose providing the first server with the temporary 
credentials, the credential module and identification service, together being operable to 
provide the first server with the temporary credentials enabling the first server to provide the 
second server with the credentials to access the second server on behalf of the client. 

34> In a related field of invention, Brown is directed towards a system for enabling a user 
to access protected resources. Brown further discloses a system that enables a proxy device to 
access protected resources using the credentials and rights of a user device Brown discloses an 
proxy server receiving the temporary credentials that were generated for a client, and 
provides a data service with the temporary credentials to access the data service on behalf of 
the client [0019, 0020, 0022]. According to Brown, it is advantageous to provide a proxy server 
that obtains the temporary credentials for a user, and access the requested services on behalf 
of a user because such an implementation increases the level of security and enabling user 
access from multiple locations[oo26, 0027]. Therefore, it would have been obvious to one of 
ordinary skill in the art to modify Win's resource access system to include the proxy server 
functionality provided by Brown's teachings. The combination of Win and Brown would 
thus provide a system where a proxy obtains credentials of a user and accesses a data service 
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on behalf of the user when the user makes a request for resources. One would have been 
motivated to provide such an implementation for the advantages discussed. 

35> As to claims 45-48, as they are mediums that execute the steps of the method of claims 
2-5, respectively, they do not teach or further define over the claimed limitations. Therefore 
claims 45-48 are rejected for the same reasons set forth for claims 2-5, supra. 

36> As to claim 49, Win discloses a system for accessing a data service comprising: 

an identification service operable to receive profile data from a client identifying a 
particular profile and to provide that profile, the profile to contain electronic data used to 
identify the data service [column 9 «lines 33'6o» | column 10 «lines 4i-63»]; 

a credential module operable to obtain the profile from the identification service, 
generate temporaiy credentials, and map those credentials to the data service identified by 
the profile [Figure 4 | column 9 «lines 30-40» | column 10 «lines 49-63»]; 

an application server operable to serve an interface containing instructions to send 
profile data to the identification service. 

Win does not explicitly disclose that the application server obtains the temporary 
credentials, and provides the data service with the temporary credentials to access the data 
service on behalf of the client. 



37> Brown is directed towards a system for enabling a user to access protected resources. 
Brown further discloses a system that enables a proxy device to access protected resources 
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using the credentials and rights of a user device Brown discloses an proxy server receiving 
the temporary credentials that were generated for a client, and provides a data service with 
the temporai-y credentials to access the data service on behalf of the client [0019, 0020, 0022]. 
According to Brown, it is advantageous to provide a proxy server that obtains the temporary 
credentials for a user, and access the requested services on behalf of a user because such an 
implementation increases the level of security and enabling user access from multiple 
locations[oo26, 0027]. Therefore, it would have been obvious to one of ordinaiy skill in the 
art to modify Win's resource access system to include the proxy server functionality 
provided by Brown^s teachings. The combination of Win and Brown would thus provide a 
system where a proxy obtains credentials of a user and accesses a data service on behalf of the 
user when the user makes a request for resources. One would have been motivated to pi'ovide 
such an implementation for the advantages discussed. 

38> As to claim 50, Win discloses the system wherein the credential module is further 
operable to invalidate the temporaiy credentials following a termination event [column 11 
«lines 6-9»]. 

39> As to claim 51, Win discloses: 

an application content provider in communication with the application server and 
operable to generate content for directing an application [Figure 4 «item 4I2» | column 9 

«lines 28-29»]; and 
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a data content provider in communication with the application server and operable to 
generate content for selecting electronic files managed by the accessed data service [Figure 4 
«item 2o8» | column 3 «lines 36-40»]. 

40> As to claim 54, Win discloses a system for accessing a data service comprising: 

an identification service operable to generate a profile interface having user accessible 
controls for creating a profile containing electronic data used to identify the data service, to 
create a profile using selections made through the profile interface, to issue instructions to 
store profile data used to access the created profile, to receive from a client, profile data 
identifying a particular profile, and to provide that profile [Figure 4 | column 7 «lines 45-57» | 
column 9 «lines 20''6o» | column 10 «lines 4i-55»]; 

a credential module operable to obtain the profile from the identification service, 
generate temporary credentials, and map those credentials to the data service identified by 
the profile [Figure 4 | column 9 «lines 30-40» | column 10 «lines 49-63»]; 

an application server operable to serve an interface containing instructions to send 
profile data to the identification service. 

Win does not explicitly disclose that the application server obtains the temporary 
credentials, and provides the data service with the temporary credentials to access the data 
service on behalf of the client. 

4i> Brown is directed towards a system for enabling a user to access protected resources. 
Brown further discloses a system that enables a proxy device to access protected resources 
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using the credentials and rights of a user device Brown discloses an proxy server receiving 
the temporary credentials that were generated for a client, and provides a data service with 
the temporaiy credentials to access the data service on behalf of the client [0019, 0020, 0022]. 
According to Brown, it is advantageous to provide a proxy server that obtains the tempoi'aiy 
credentials for a user, and access the requested services on behalf of a user because such an 
implementation increases the level of security and enabling user access from multiple 
locations[oo26, 0027]. Therefore, it would have been obvious to one of ordinary skill in the 
ait to modify Win*s resource access system to include the proxy server functionality 
provided by Brown's teachings. The combination of Win and Brown would thus provide a 
system where a proxy obtains credentials of a user and accesses a data service on behalf of the 
user when the user makes a request for resources. One would have been motivated to provide 
such an implementation for the advantages discussed. 

42> As to claims 55 and 56, as they not teach or further define over the limitations of 
claims 50 and 51 respectively, they are rejected for the same reasons set forth for claims 50 and 
51. 



43> As to claim 58, Win discloses the system of claim 54 further comprising a browser 
operable to request and display the profile and application interfaces [Figure 4]. 
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44> As to claim 59, as it is a claim to a system that contains the functionality of the 
medium of claim 38, it does not teach or further define over the claimed limitations. 
Therefore, claim 59 is rejected for the same reasons set forth for claim 38, supra. 

45> Claims 13, 20, 31, 43, 52, 53, and 57 are rejected under 35 U.S.C § 103(a) as being 
unpatentable over Win and, in further view of Curtin, "A Failure to Communicate: When a 
Privacy Seal doesn't help" ["Curtin"]. 

46> Curtin was cited by Examiner in previous Office Action, 4.15.2005. 

47> As to claim 13, Win discloses a request including a cookie identifying a particular 
profile [column 10 «lines 5i-54»] but does not disclose including instructions to request a web 
bug from the identification service, and wherein the act of sending the profile data includes 
requesting the web bug. 

48> Curtin discloses including instructions to request a web bug from the identification 
service, and wherein the act of sending the profile data includes requesting the web bug [see 
1.4 "Web Bugs" and "B. TheCounter.com Tracking Code" page 7]. Curtin discloses the use 
of the web bug to allow for web sites to track and monitor the actions of users in an almost 
invisible manner. Therefore, it would have been obvious to one of ordinaiy skill in the art to 
incorporate Curtin*s web bug functionality into Win's resource accessing system to allow 
administrators access to user activity. Such a functionality would enable administrators the 
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ability profile users and keep track of their use of web servers [see Curtin, 2.2.2 Profiling 
Capability and 1.4 Web Bugs]. 

49> As to claims 20 and 31, as they do not teach or further define over the claimed 
limitations, they are rejected for the same reasons set forth for claim 13. 

50> As to claim 43, as it is a claim to a medium that executes the steps of the method of 
claim 13, it does not teach or further define over the claimed limitations. Therefore, claim 43 
is rejected for the same reasons set forth for claim 13. 

5i> As to claims 52, 53 and 57, as it is does not teach or further define over the combined 
limitations of claims 11 and 13, claims 52, 53 and 57 are also rejected for the same (combined) 
reasons set forth for claims 11 and 13, supra. 

Conclusion 

Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutoiy period, then the 
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shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the 
advisoi-y action. In no event, however, will the statutory period for reply expire later than 
SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Dohm Chankong whose telephone number is (571)272-3942. 
The examiner can normally be reached on 8:30AM - 5:30PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supei-visor, Glenton Burgess can be reached on (571)272-3949. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status information 
for unpublished applications is available through Private PAIR only. For more information 
about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217- 
9197 (toll-free). ^^^0>^^ 

DungC.Din'r. 
Primary ExaminP'^ 
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